I have 2 vlans at home. I need to access an Android Tablet on the first vlan from a device on the second vlan on protocol FTP. The FTP server being an Android Tablet I cannot set port 21 to be used and I can't choose the passive ports.
I added a firewall rule to allow the communication on the custom FTP port (2121) and activated the ftp helper for this rule. I installed the kmod-nf-nathelper package and restarted the firewall as indicated here.
config rule
option name 'Allow-Forward-Lan-Tablet (FTP)'
list proto 'tcp'
option src 'lan'
option dest 'restricted'
list dest_ip '192.168.3.35'
option target 'ACCEPT'
option dest_port '2121'
option helper 'ftp'
The problem is that with this configuration I can't even connect on port 2121.
ftp> open
(to) tablet.restricted 2121
ftp: Can't connect to `192.168.3.35:2121': Connection refused
ftp: Can't connect to `tablet.restricted:2121'
ftp>
If I remove the helper option, I can connect but the data transfer can't happen.
ftp> open
(to) tablet.restricted 2121
Connected to tablet.restricted.
220 SwiFTP 3.1 ready
Name (tablet.restricted:user): myuser
331 Send password
Password:
230 Access granted
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (192,168,3,35,159,81).
ftp: Can't connect to `192.168.3.35:40785': Connection refused
200 PORT OK
425 Error opening data socket
ftp>
How come I can't even connect on port 2121 if the helper option is enabled?
Is the FTP helper working only if the FTP port is 21 (thus the rule is not even used if the open port is 2121 in my case)?
Is there a way to make it work without opening any other port(s) between the 2 vlans?
Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have
ubus call system board; \
fw4 restart; nft list ruleset
You mean active mode? Where the server connects to the client on a random port?
That wouldn't work as the firewall would prevent the server (Android Tablet) to connect. And I also have no way to put the server (Android Tablet FTP Server) in this mode.
Like I said, I can't change anything on the server as it is an Android tablet.
Shouldn't fw4 also add a rule for the dest_port mentionned in the rule in addition to the standard port?
I'm not very familiar with nft rules (I have more knowledge with iptables), but I managed to manually add the rule (first only on helper_lan chain, and then also on helper_restricted), but it is still not working. I get "connection refused" on port 2121, meaning that not even the connection on that port works with the helper rule. If I remove the helper, I can connect on port 2121, but can't do any transfer.
chain forward_lan {
ip daddr 192.168.3.35 tcp dport 2121 ct helper "ftp" counter packets 0 bytes 0 jump accept_to_restricted comment "!fw4: Allow-Forward-Lan-Tablet (FTP)"
jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
ct status dnat accept comment "!fw4: Accept port forwards"
jump accept_to_lan
}
chain helper_lan {
tcp dport 2121 ct helper set "ftp" comment "test"
tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
meta nfproto ipv4 tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
}
chain helper_restricted {
tcp dport 2121 ct helper set "ftp" comment "test"
tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
meta nfproto ipv4 tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
}
ftp> open
(to) tablet.restricted 2121
ftp: Can't connect to `192.168.3.35:2121': Connection refused
ftp: Can't connect to `tablet.restricted:2121'
ftp>
I managed to make it work by removing the FTP Helper from the rule and manually adding a rule with port 2121 on helper_lan chain.
chain forward_lan {
ip daddr 192.168.3.35 tcp dport 2121 counter packets 0 bytes 0 jump accept_to_restricted comment "!fw4: Allow-Forward-Lan-Tablet (FTP)"
jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
ct status dnat accept comment "!fw4: Accept port forwards"
jump accept_to_lan
}
chain helper_lan {
tcp dport 2121 ct helper set "ftp" comment "test"
tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
meta nfproto ipv4 tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
}
I don't know why I can't even connect on port 2121 when the helper is included in the rule from the chain forward_lan.
Also I am not sure how I can add the rule that I added manually in the helper_lan chain from uci config (or firewall config file), if it is possible at all...
